#!/bin/bash

# ----------------------------------------------------------------------
# Filename:   save.sh
# Version:    1.0
# Date:       2013/12/05
# Author:     huijing.hei
# Email:      huijing.hei@cs2c.com.cn
# Summary:    03系统安全功能-03IPTables-02IPTables基本策略和简单规则配置-08规则保存和恢复
# Notes:       ***
# Copyright:    China Standard Software Co., Ltd.
# History：     
#             Version 1.0, 2013/12/05
#             - iptables add default rules.
# ----------------------------------------------------------------------

##! @TODO:  iptables start
##! @AUTHOR: huijing.hei
##! @VERSION: 1.0 
##! @OUT: 0 => success; 1 => failure

function DoSetup()
{
    trap DoCleanup INT EXIT
    serv=iptables
    CheckServiceExists  ${serv}
    EchoResult "check service"

#    RestartDaemon ${serv}
#
#    # check iptablesd start
#    StatusDaemon ${serv} && lsmod | grep ip_tables
#    EchoResult "${serv} : start"

    # tmpdir
    TMPDIR=/tmp/iptables$$
    mkdir ${TMPDIR}
    EchoResult "mkdir ${TMPDIR}"

    # clear iptables rules
    iptables -P INPUT ACCEPT
    EchoResult "iptables -F INPUT"

    iptables -P OUTPUT ACCEPT
    EchoResult "iptables"

}

##! @TODO:  iptables add rules
##! @AUTHOR: huijing.hei
##! @VERSION: 1.0 
##! @OUT: 0 => success; 1 => failure

function DoTest()
{
    # iptables add rules

    # add 
    iptables -P INPUT ACCEPT
    EchoResult "iptables -P INPUT ACCEPT"
    # check
    iptables -L
    EchoResult "iptables -L"
    # ping, should success
    ping -c 2 127.0.0.1
    EchoResult "add iptables rules, ping 127.0.0.1, should success"


    # add rules for OUTPUT
    iptables -P OUTPUT DROP
    EchoResult "iptables -P OUTPUT DROP"
    # check
    iptables -L | grep "Chain OUTPUT (policy DROP)"
    EchoResult "iptables -L"

    # ping, should success
    ! ping -c 2 127.0.0.1
    EchoResult "ping: sendmsg: Operation not permitted"

    ## iptables save
    service iptables save
    EchoResult "save rules to iptables"

    local IPSAVE=""
    if [ -f /etc/sysconfig/iptables.save ];then
        IPSAVE=`grep -A 3 filter /etc/sysconfig/iptables.save | grep OUTPUT | awk '{print $2}'`

        # restore rules
        mv -f /etc/sysconfig/iptables.save /etc/sysconfig/iptables
        EchoResult "mv iptables.save iptables"
    else
        IPSAVE=`grep -A 3 filter /etc/sysconfig/iptables | grep OUTPUT | awk '{print $2}'`
    fi

    # restart
    RestartDaemon ${serv}
    EchoResult "restart ${serv}"

    iptables -L
    EchoResult "iptables -L"

    # check iptables save configfile
    if [ "${IPSAVE}" = "DROP" ];then
        ! ping -c 2 127.0.0.1
        EchoResult "because iptable.save is ${IPSAVE}, ping should failed"
    elif [ "${IPSAVE}" = "ACCEPT" ];then
        ping -c 2 127.0.0.1 
        EchoResult "because iptable.save is ${IPSAVE}, ping should successed"
    elif [ "x${IPSAVE}" = "x" ];then
        echo "FAIL | pls check /etc/sysconfig/iptables"
    fi


}

##! @TODO: cleanup
##! @AUTHOR: huijing.hei
##! @VERSION: 1.0 
##! @OUT: 0 => success; 1 => failure

function DoCleanup()
{
    iptables -P INPUT ACCEPT
    iptables -P OUTPUT ACCEPT
    StopDaemon ${serv}
    [ -e "${TMPDIR}" ] && rm -rf ${TMPDIR}
}

# include lib files
if [ -z "$SFROOT" ]
then
    echo "SFROOT is null"
    exit 1
fi

. ${SFROOT}/lib/Echo.sh
. ${SFROOT}/lib/NetOps.sh

export LANG=C

DoSetup
DoTest
